maqp
Joined 11 years ago
Karma
972
Submissions
729
Member since
Aug 8
Recent submissions
Comment · 15 hours ago
Comment · 15 hours ago
Oh look it's me.
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
Comment · 15 hours ago
You need to fix your shill propaganda. It's 4 months i.e. 120 days, not 4 weeks, before they delete your account https://github.com/signalapp/Signal-Server/blob/7f5097bd3317...
Comment · 16 hours ago
It's not that they're not interested in user freedom and respect. They just have different ideas about what's important. If Signal federates, that will bring to the table all sorts of 3rd party clients who will have say in how Signal does things, yet no duty to comply with the Signal's spec sheet and deploy timely protocol updates and features. Any clients not keeping up are damaging the brand, as was in the case of Matrix clients' poor support for E2EE. Then there's the aspect that the larger the organization managing the spec becomes, the easier it is to infiltrate and clog with bikeshedding.
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
Comment · 16 hours ago
Signal isn't anonymous. The server has access to your IP addresses and the server can at will build social graphs about the users.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
Comment · 16 hours ago
>You're also hedging against mandated government backdoors.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
https://en.wikipedia.org/wiki/Code_as_speech goes into this in more detail and mentions https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... where the defense was used.
Comment · 2 days ago
Also his guest appearance as Alistair Burke in Frasier episode The Doctor is Out (S11E3) is nothing short of hilarious.
The episode is classic sitcom "wrong conclusion escalates out of hands" so I highly recommend watching it in full instead of the clips but if it's not on your streaming platform, Stewart's scenes are cut together in
Comment · 9 days ago
'Kovan viikon ilta' (the Finnish weekly late night show) said Google had filed for deforestation requests that were small enough they did not warrant an environmental impact review. But it turned out there were quite a few small, adjacent deforestation requests so yeah it was quite certainly illegal :D
Comment · 19 days ago
Would've been interesting to see something about when to use MLKEM-1024-X448 and ML-DSA-87-ed448.
Comment · 20 days ago
>demanding that we put up with lower-quality apps
No we just have different idea of what quality means.
>The only person in this thread "shilling" and "trying to control the narrative" for their own personal benefit is you.
Yes a person advocating for other people to have human right to privacy is benefitting from a better society! How selfish of me! It's really cute that you're gaslighting the hell out of your audience.
>You're also going into straight conspiracy theory territory here.
No, I'm stating that I have no proof of it, but that it's Durov's job to disprove that claim with the ubiquitous E2EE. What would you call someone who writes a non-private messenger and markets it as private?
>Telegram is allegedly a FSB op, or maybe NSA or whoever, even though the current Russian government doesn't seem to like Telegram or Durov, their CEO, much.
Yes because everyone would trust Telegram if it was the official recommendation of Russian government and FSB. You not understanding first level of misdirection is the absurd part here.
>Definitely don't worry at all about Signal's leadership and funding though!
For someone who doesn't care at all you sure have every single shill argument nailed. I've had these debates since roughly 2015 and you're no different from every other Telegram shill :)
Comment · 20 days ago
Awesome thanks for sharing!
Comment · 20 days ago
Definitely! Supcoms downfall was the poor threading support and IIRC the in-game AI path finding continuing for destroyed AI units which bogged the game down over time. At least one of them was never fixed properly.
Comment · 21 days ago
Which you a) don't even have to do https://signal.org/android/apk/ b) can pull from your phone to compare the apk hash against reproducibly built client.
Open source is not panacea, but it's a requirement for verifiable security.
So how about you show us that either the play store APK doesn't match, or, that the source has the backdoor you claim it has.
Comment · 21 days ago
>is the only thing that matters, no matter what other features you have to throw out to get it.
That's just it, it's not a false dichotomy. Proper privacy engineering can achieve tons of private actually good features. And it's also fine for Telegram to not provide it, but then you can't really market yourself as more private than WhatsApp, "heavily encrypted" etc. There's loads of people who do not know how poor Telegram's security is. Informed consent is what matters much more than dialing every security feature to 11.
>What I am calling out is that this is a fundamentally ideological point of view.
Privacy is a human right: https://en.wikipedia.org/wiki/Right_to_privacy Just because some people sell it for pennies and convenience doesn't erode that fact.
> but general readers should be aware of what they are losing in order to enact this ideology with benefits that seem to be a bit dubious in the real world.
Sounds like you're trying real hard to get people to give up their human right. Why? Do you gain something personally from people using Telegram? Why would you defend such a shit product marketed with lies?
>It is well known that Meta is happy to hand over to any legitimate law enforcement agency any content they have.
Oh so privacy does matter to you when it's Mark Zuckerberg having access to your data but not when its Mark Zuckerberg of Russia having access to your data. The fact is, Telegram looks like an FSB op, or the very least, it doesn't give hard time for nation states to access messages of billion users. Hack the server and you're done.
>To the best of my knowledge, Telegram never has, and neither has Signal.
It shows a bit poor taste to equate these two. Signal doesn't have your data because it end-to-end encrypts all messages. Telegram does the opposite.
>The fact that Telegram potentially could someday seems more theoretical to me.
Their product is now 13 years old. If they cared about user privacy they'd have already hired competent cryptographers to design a protocol that provides the security and the features.
>Again, to the best of my knowledge, all actual leaks of messaging group content have been by various authorities compromising individual devices and/or their owners, which works equally well against Telegram and Signal.
Yeah except Telegram that clearly lacks proper security team wouldn't tell if their servers were compromised. There's nothing they could do to retain user trust at that point. They don't have to care about NSA or FSB or whatever hacking their servers because those agencies aren't boasting. And yeah user endpoint exploitation is obviously out of scope for secure messaging apps as networked TCBs can't be made hardened by some app vendor. I might know something about this topic as I'm the only person who has created messaging system that gets around that issue.
>Meanwhile, Telegram gives you a lot more practical security regarding what information to share with other users, and how to manage what other users can do in large chat groups, which seems like a much more real-world concern regarding actual dangers to users than what the company that owns it might potentially do at some future date.
Telegram IS the threat, not my friends in my closed group where I never need group management. Open groups that require granular permission controls do not require end-to-end encryption. The difference is, Telegram doesn't give you choice for small private groups with friends.
>I think for real security, it's better to pay attention to the business model of the company that runs it
It's SO CUTE that you're trying to control the narrative :D No Telegram has nothing to do with real security.
If Telegram is an FSB op, there is no business model. And if not, nothing prevents selling Telegram and its users and decades worth of data once it becomes unusable. Telegram is surveillance capitalistic, but the sale hasn't happened yet. You don't slaughter the piglet until it's grown. How many times do people need to repeat the same mistake of getting f'd by companies that betray them when it's time. You'd probably actually want to look into Signal's direction as it's a 501c3 non-profit, meaning it can't be sold.
>But on Signal, you're screwed if it's your mobile, and fine if it's any other device.
No you can just install Signal on new phone if old is stolen https://support.signal.org/hc/en-us/articles/360007062452-Wh... Then you just re-link your other devices to the new phone. It's the phone access controls' job to protect from accessing the messages.
>Though since you mentioned backups, I think Telegram's way is arguably more secure. Individual user backups, even encrypted, means all your communication security is at the mercy of whoever in your group has the weakest encryption keys and backup storage location. With a centralized system like Telegram, it's never anywhere but their servers.
Signal's backup storage location is at Signal's servers. The app generates a 256-bit encryption key for you. If you choose to use manual backups and upload them to some random ass company, then that's poor judgement on behalf of that person. The only thing worse, would be if Telegram would make that decision for EVERY group member, every time, with no chance to opt out :)
Your mental gymnastics are so insane if you aren't getting paid to shill Telegram, you definitely need to apply https://telegram.org/jobs
Comment · 21 days ago
>Which privacy/security aficionados think everyone is obsessed about.
If you want to vomit your entire digital social life to some random company in Dubai and to every party who hacks their servers, you do you.
No they're all routed through the servers. It's only the calls that can be sent P2P and you have to opt in for that. The issue is that leaks your IP address to the contact who may not be trustworthy, so it's not used by default.